/*
 * This kernel module locates the sys_call_table by
 * kallsyms_lookup_name("sys_call_table"); debian 9 4.9.0-13-amd64 passed debian
 * 10 4.19.0-10 amd64 passed ubuntu 5.4.0-65 amd64 passed
 */

#include <linux/kernel.h>
#include <linux/module.h>

#include "syscall_hook/syscall_hook.h"

HOOK(execve)
asmlinkage long hooked_execve(const char __user* filename,
                              const char __user* const __user* argv,
                              const char __user* const __user* envp)
{
    printk("hooked_execve:%s\n", filename);
    return execve(filename, argv, envp);
}

HOOK(getuid)
asmlinkage long hooked_getuid(void)
{
    printk("hooked_getuid:%s\n", current->comm);
    return getuid();
}

syscall_hook_list_t list[] = {
    SYSCALL_HOOK_INIT(getuid, hooked_getuid),
    SYSCALL_HOOK_INIT(execve, hooked_execve),
};

syscall_hook_ctx_t ctx;

// initialize the module
static int hook_init(void)
{
    int ret = 0;
    ret     = syscall_hook_init(&ctx, list, ARRAY_SIZE(list));
    if (ret) {
        printk("syscall init false.\n");
        return ret;
    }
    printk("+ syscall hook init done!\n");
    return ret;
}

static void hook_exit(void)
{
    syscall_hook_clean(&ctx, list, ARRAY_SIZE(list));
    printk("+ syscall hook clean\n");
}

/*
** entry/exit macros
*/
module_init(hook_init);
module_exit(hook_exit);

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Nong GuangXin");
MODULE_DESCRIPTION("syscall hook tools");
